Loading story…
Threat actors have been targeting poorly secured, internet-exposed Microsoft SQL Server instances to deliver Mimic and Trigona ransomware, using brute-force or weak credentials and, in some cases, xp_cmdshell for command execution. Researchers reported that one actor used the SQL Server Bulk Copy Program (BCP) utility to rebuild malware from database contents onto disk, while other intrusions relied on PowerShell download cradles, mounted SMB shares, and remote access tools including AnyDesk. In multiple cases, the attackers established persistence, created administrator accounts, enabled credential theft opportunities such as the WDigest\UseLogonCredential registry setting, and deployed tooling including Mimikatz, PsExec, Advanced Port Scanner, Defender Control, and SDelete.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
AhnLab assessed that the early-January Mimic incident and mid-January Trigona incident were likely conducted by the same threat actor. The linkage was based on shared MSSQL targeting, identical BCP-based installation, reused strings and paths, and overlapping supporting malware.
In mid-January 2024, AhnLab identified similar attacks in which the same installation method was used but Trigona ransomware was deployed instead of Mimic. The activity again targeted poorly managed, externally exposed MS-SQL servers.
AhnLab ASEC first discovered a case in early January 2024 where attackers used the MS-SQL Bulk Copy Program utility to reconstruct and install Mimic ransomware from database contents onto disk. The attack targeted a poorly managed, externally exposed MS-SQL server.
Trend Micro said a new 64-bit Windows version of Trigona was encountered in June 2023. This variant added command-line arguments such as /sleep and /debug.
Trend Micro reported that a Linux version of Trigona was found in May 2023. The Linux binary shared similarities with the Windows counterpart and accepted command-line arguments for execution.
AhnLab previously reported in April 2023 that Trigona targeted poorly managed MS-SQL servers. Trend Micro likewise noted that by April 2023 Trigona had begun targeting compromised MSSQL servers using stolen or brute-forced credentials.
AhnLab cited an Arete report from February 2023 stating that Trigona exploited the ManageEngine vulnerability CVE-2021-40539 for initial access. Trend Micro also noted this exploitation path in its overview.
Trend Micro said the Trigona ransomware family became active around late October 2022. The operators subsequently continued updating the malware across multiple variants.
AhnLab stated that Mimic ransomware was first identified in June 2022. The family is known for using the Everything file-search tool and borrowing some features from leaked Conti source code.
Trend Micro reported that samples of the Trigona ransomware family existed as early as June 2022, predating its broader observed activity. AhnLab also described Trigona as active since at least June 2022.
Securonix reported an ongoing campaign it tracks as RE#TURGENCE in which likely Turkish, financially motivated actors brute-force exposed MSSQL servers, abuse xp_cmdshell, and either sell access or deploy Mimic ransomware. In the observed intrusion, the attackers used PowerShell download cradles, an obfuscated Cobalt Strike beacon, AnyDesk, Mimikatz, Advanced Port Scanner, and PsExec before manually deploying Mimic across the domain.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securonix.com
Open sourceasec.ahnlab.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers targeted externally exposed, unpatched **Microsoft SQL Server** systems by exploiting `CVE-2019-1068` and `CVE-2020-0618`, then delivered a mix of malware and ransomware through shared infrastructure and tooling. Sophos linked the intrusions through common ingress methods, command-and-control servers, PowerShell downloaders, a **.NET downloader**, **Remcos RAT**, the **Kill$** cleaner, and **7zip SFX**-based loaders, with ransomware payloads including **TargetCompany/Mallox** and **GlobeImposter/Alpha865qqz**. Most victims were observed in Asia, with additional cases in the Americas, and Chinese-language comments in some tools suggested the operators may be based in Asia. In one investigated case, the attackers returned after an earlier ransomware incident because the SQL Server remained unpatched, showing how exposed systems can be repeatedly compromised until the root weakness is fixed. Sophos said its defenses blocked follow-on payload delivery and prevented lateral movement, data exfiltration, and further ransom escalation, while responders also identified **IOBit Unlocker** as an attempted anti-security utility. Continued traffic to a fake **KMSAuto**-themed download site helped tie the customer incident to the wider campaign.
Aug 15, 2026
AhnLab said the **Larva-26002** threat actor is continuing a multi-year campaign against poorly secured, internet-exposed **Microsoft SQL Server** systems, shifting from direct ransomware deployment to using compromised servers as part of a broader scanning operation. The group previously deployed **Trigona** and **Mimic** ransomware, abused the legitimate **BCP** utility to reconstruct malware from database contents, and installed remote access tools including **AnyDesk**, **Teramind**, and port-forwarding utilities. Researchers said the actor has repeatedly targeted servers with weak credentials and has continued to revisit previously compromised systems. In the latest activity, the actor deployed the Go-based **ICE Cloud** malware family, including **ICE Cloud Launcher** and **ICE Cloud Client**, to authenticate with a command-and-control server, receive MSSQL scanning assignments, brute-force target servers with supplied credentials, and report successful logins back to the operator. AhnLab linked the campaign to earlier Mimic-related activity through Turkish-language strings and recurring artifacts such as the table name `uGnzBdZbsi` and format file `FODsOZKgAU.txt`, indicating continuity in tooling and tradecraft. The campaign suggests the group is building a distributed infrastructure to identify vulnerable database assets at scale, while defenders are being urged to strengthen passwords, rotate credentials, update security software, and restrict public database access with firewall controls.
Jun 29, 2026
The **Kingminer** botnet has been repeatedly observed compromising publicly exposed **Microsoft SQL Server** instances by brute-forcing weak credentials on TCP port `1433`, then deploying cryptocurrency miners and follow-on tooling. Researchers linked these intrusions to opportunistic campaigns that install customized **XMRig** miners, use downloader scripts and fileless **PowerShell** execution, and in some cases deliver **Cobalt Strike** beacons for persistence and post-compromise control. Investigations also found payload staging through **GitHub**, abuse of legitimate Windows binaries including `MSBuild.exe`, `rundll32.exe`, `control.exe`, and `main.cpl`, and injection into trusted processes such as `wwanmm.dll` to reduce detection. Threat reports describe Kingminer as a moderately sophisticated criminal botnet that combines public offensive tools with custom malware components, including reflective loading, DLL side-loading, and credential theft capabilities derived from tools such as **Mimikatz**. In one investigated intrusion, `sqlservr.exe` launched an obfuscated VBScript that downloaded a standalone PowerShell binary and executed additional scripts in memory before starting a miner. The malware also checked systems for **BlueKeep**-related hotfixes `KB4499175` and `KB4500331` and disabled **RDP** on vulnerable hosts, apparently to block competing botnets from exploiting the same machines. Defenders were advised to enforce strong SQL passwords, restrict internet exposure, patch public-facing services, and improve logging and monitoring, as repeated attack attempts stopped once the underlying weakness was remediated.
Aug 14, 2026